High severity · published Jul 26, 2024
CVE-2024-41692
Incorrect Access Control Vulnerability
8.6
CVSS
0.3%
EPSS
No
On KEV
Description
This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to presence of root terminal access on a serial interface without proper access control. An attacker with physical access could exploit this by accessing the root shell on the vulnerable system.
Successful exploitation of this vulnerability could allow the attacker to execute arbitrary commands with root privileges on the targeted system.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 19% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SS
SyroTech SY-GPON-1110-WDONT router · SyroTech
3.1.02-231102 · source: vendor
SF
Sy-gpon-1110-wdont Firmware · Syrotech
3.1.02-231102 · source: CISA
Affected product
SS
SyroTech SY-GPON-1110-WDONT router
SyroTech
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-41692
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-41692
www.cert-in.org.in
https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0225
cert-in.org.in
https://cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0225
More from SyroTech SY-GPON-1110-WDONT router
7.5
CVE-2024-41687
Cleartext Transmission of Sensitive Information Vulnerability
7.5
CVE-2024-41685
Cookie Without HTTPOnly Flag Set Vulnerability
5.3
CVE-2024-41684
Cookie Without Secure Flag Set Vulnerability
4.6
CVE-2024-41691
Insecure Storage of Sensitive Information Vulnerability
4.6
CVE-2024-41690
Default Credential Storage in Plaintext Vulnerability
